Saturday, 7 November 2026

TCP Sliding Window Protocol & Flow Control: rwnd, cwnd, ACKs, Numericals and MCQs

Computer Networks · Transport Layer · Lesson 07

TCP Sliding Window Protocol and Flow Control — Receiver Window, Cumulative ACKs, Lost Segments & Numericals

Understand exactly which bytes can be sent, which bytes must wait, and how TCP recovers from gaps. This tutorial follows Tanenbaum and Forouzan with exam-focused explanations, original responsive diagrams and interactive demonstrations.

APPSC Assistant ProfessorUGC NETGATE CSRGUKT LecturerTanenbaum + Forouzan

TCP sliding window is a byte-oriented, dynamically sized mechanism that permits multiple bytes to be in transit while keeping the sender within the receiver's available buffer space. In practice, the sender's transmission is limited by both the receive window (rwnd) and the congestion window (cwnd).

1. What Is the TCP Sliding Window Protocol?

TCP uses a sliding window to allow a sender to transmit more than one piece of data before waiting for an acknowledgement. Instead of a stop-and-wait exchange, TCP keeps a pipeline of bytes in flight. As acknowledgements arrive, the left boundary of the send window advances and new data can become eligible for transmission.

Byte oriented

TCP numbers individual bytes. A single segment may cover many consecutive byte numbers.

Variable sized

The permitted window can change as the receiver consumes data and network conditions change.

Cumulative ACKs

An ACK indicates the next contiguous byte expected, not the most recently arrived segment.

Textbook comparison: Forouzan §23.3 calls TCP's window byte-oriented and variable-sized, whereas the earlier data-link-layer windows in that book are frame-oriented and illustrated as fixed-size. TCP may buffer out-of-order bytes rather than automatically discarding them.

2. The Four Regions of a TCP Sender Window

Visualize the TCP byte stream as four groups: acknowledged bytes, sent but unacknowledged bytes, bytes that can be sent now, and bytes temporarily blocked outside the current window.

Original concept diagram — a 9-byte effective window

ACK = 200rwnd = 9 bytescwnd = 20 bytes
199ACKed
200Sent
201Sent
202Sent
203Can send
204Can send
205Can send
206Can send
207Can send
208Can send
209Blocked
Based on the logic of Forouzan Example 23.6 (p. 731, Fig. 23.23). Window bytes 200–208 are eligible; bytes 200–202 are already outstanding; six additional bytes 203–208 may be sent. Byte 209 waits until the window advances or opens.
Window rightmost byte = ACK + Window size − 1
New-data allowance ≈ Effective window − Bytes already in flight

Here the window contains min(9,20)=9 bytes. Of those, three are outstanding, so six new bytes are currently allowed.

Opening: right boundary moves right and allows additional bytes. Sliding (closing the left): acknowledgements advance the left boundary. Shrinking: moving the right edge backward is strongly discouraged because the sender may already have transmitted bytes relying on the earlier permission.

3. Receiver Window (rwnd) vs. Congestion Window (cwnd)

rwnd — Receiver flow-control limit

Determined by the receiving TCP from available buffer capacity. Advertised to the sender in TCP's Window field (with scaling when negotiated).

cwnd — Sender congestion-control limit

Maintained by the sender, based on congestion-control logic and feedback. Not a value directly transmitted in the TCP header.

Effective sending window = min(rwnd, cwnd)
Simplified rwnd = Receive buffer capacity − Bytes occupying buffer

Forouzan Examples 23.4 and 23.5 illustrate both calculations. With a 5000-byte buffer holding 1000 unread bytes, rwnd=4000. If rwnd=3000 and cwnd=3500, the effective window is 3000 bytes.

Exam trap: An ACK and a receiver-window advertisement carry different information. A receiver may acknowledge previously arrived bytes yet still advertise a zero window because its application has not removed them from the buffer.

4. Interactive TCP Receive-Buffer and Window Demonstration

Consider a receiver with a 4096-byte buffer, an empty starting buffer, and a sender whose first data byte is numbered 1000. Click through the steps to see how ACK and rwnd change independently. This is a numerically adjusted recreation of the concept in Tanenbaum Figure 6-40.

Receive buffer: eight cells, 512 bytes each

Step 0 · Empty bufferUsed: 0 / 4096 B

Next ACK

1000

Advertised rwnd

4096 B

New step

No bytes sent

Receiver empty: cumulative ACK=1000, available rwnd=4096 B. The sender may fill the advertised space, subject to cwnd.
Model assumes no receiver-window scaling and no other unprocessed bytes. The 512-byte cells are only a teaching visualization; real TCP buffers are not restricted to eight fixed cells.
TCP SenderData segments
TCP ReceiverReceive buffer
2 KB
ACK

Animated concept: the blue data packet moves sender → receiver while the green ACK moves receiver → sender. Motion illustrates exchanges rather than actual network timing. Motion pauses when requested and respects reduced-motion preferences.

5. Cumulative ACKs, Lost Segments and Out-of-Order Reception

The TCP acknowledgement number represents the next byte expected in order. If data arrive beyond a missing range, the cumulative ACK normally stays at the beginning of the gap. Modern implementations commonly buffer those later bytes; SACK, when enabled, can report the out-of-order ranges separately.

Try a lost-segment scenario

500 bytes per segmentStep 0 / 5
No segment delivered yet. Receiver expects byte 1000, so cumulative ACK=1000.
Original illustration of TCP's cumulative ACK rule (Tanenbaum pp. 567–568 and Forouzan pp. 731–733). Lost bytes 1500–1999 keep ACK at 1500 despite the arrival of later ranges; when the retransmission fills the gap, ACK jumps to 3000.
Lost packet vs. lost ACK: If an ACK is lost but a later cumulative ACK arrives, the later ACK can cover the previously acknowledged bytes. If a data segment is missing, however, the receiver cannot cumulatively acknowledge beyond that hole.

6. Zero Window, Window Probes, Delayed ACK, Nagle and Silly Window Syndrome

6.1 Zero receiver window (rwnd = 0)

If the application reads no data and the buffer fills, the receiver may advertise rwnd=0. A sender normally stops new data transmission until more room becomes available. In Tanenbaum Figure 6-40, ACK moves forward as bytes arrive, but the advertised window can simultaneously fall to zero.

6.2 Window probes and the persist problem

Suppose the receiver later frees space and sends a window-update segment, but that update is lost. The sender still believes the window is zero and may wait indefinitely. TCP can transmit a window probe to elicit the receiver's latest ACK and window advertisement. The textbook discusses a 1-byte probe exception.

6.3 Delayed ACK

Instead of immediately sending a standalone ACK for every arriving segment, a receiver can delay it briefly in the hope that useful outgoing data will allow piggybacking. Tanenbaum's historical discussion mentions up to 500 ms; this is a textbook explanation, not a recommendation to use 500 ms in every current implementation.

6.4 Nagle's algorithm

The sender transmits the first small piece promptly, then buffers subsequent small writes while an earlier small piece is still unacknowledged, unless enough bytes accumulate to transmit a full MSS. This reduces the number of small packets but can introduce delay for interactive workloads. The socket option TCP_NODELAY is commonly used to disable Nagle's algorithm where appropriate.

6.5 Silly window syndrome (SWS)

When the receiving application reads only one byte at a time, the receiver may repeatedly advertise one byte of free space; the sender responds with 1-byte data segments and disproportionate header overhead. In the textbook's Clark approach, the receiver avoids issuing tiny updates until it can accept at least an MSS or half its buffer, whichever is smaller.

Nagle → Sender side

Controls tiny writes from sending applications, preferring fewer, larger segments.

Clark → Receiver side

Controls tiny window advertisements caused by receiver reads, preferring useful space increments.

Do not confuse: A zero advertised window usually indicates receiver buffer pressure. Congestion-related limitation is instead represented by the sender's cwnd. Both can limit sending, but they solve different problems.

7. Flow Control vs. Error Control vs. Congestion Control

AspectFlow controlError controlCongestion control
Primary concernReceiver cannot accept more bytesBytes lost/corrupted/out of orderNetwork cannot carry offered load
Key TCP signalsAdvertised rwndACK, sequence numbers, SACK, retransmission timerSender's cwnd, loss/ECN feedback
Important mechanismVariable-size sliding windowChecksum, cumulative ACK, retransmissionSlow Start, AIMD, congestion avoidance
Can sender continue?Only while permitted by receive windowMay retransmit lost dataSubject to current congestion window

Forouzan comparison: TCP's window has aspects of both Go-Back-N and Selective Repeat. Cumulative ACKing resembles Go-Back-N; buffering out-of-order data resembles Selective Repeat. However, TCP is byte-oriented, not simply either of those frame-oriented protocols.

8. Solved TCP Sliding-Window Numerical Problems

Example 1 — Receiver-window calculation (Forouzan Example 23.4)

Given: Receive buffer capacity = 5000 B; unread data = 1000 B.

rwnd = 5000 − 1000 = 4000 B

Answer: rwnd = 4000 bytes.

Example 2 — Effective window (Forouzan Example 23.5)

Given: rwnd = 3000 B, cwnd = 3500 B.

Effective window = min(3000, 3500) = 3000 B

Answer: 3000 bytes; receiver window is limiting.

Example 3 — Outstanding bytes and usable space (Forouzan Example 23.6)

Given: ACK = 200, rwnd = 9, cwnd = 20; bytes 200–202 already sent.

The effective window covers bytes 200–208, so 3 are outstanding and 6 new bytes remain sendable.

Allowance = min(9, 20) − 3 = 6 B

Answer: bytes 203–208 may be sent; byte 209 cannot.

Example 4 — TCP cumulative acknowledgement after a gap

Received 1000–1499; missing 1500–1999; received and buffered 2000–2499 and 2500–2999.

Answer before retransmission: ACK = 1500.

After the missing 1500–1999 bytes arrive:

Next expected byte = 3000

Answer after retransmission: ACK = 3000.

Example 5 — How much data can be sent next?

Given: rwnd = 12 KiB; cwnd = 8 KiB; bytes still unacknowledged = 3 KiB.

New allowance = min(12,8) − 3 = 5 KiB

Answer: 5 KiB, under the simplified aligned-window assumption.

Example 6 — Zero-window reopening

Given: Receiver buffer = 4096 B, initially full (rwnd = 0). Application reads 1536 B, and no additional data arrive.

Updated rwnd = 4096 − (4096 − 1536) = 1536 B

Answer: Receiver can advertise a 1536-byte window when it sends a window update.

Example 7 — Window scaling

Given: Advertised TCP window field = 3000 and negotiated window-scale shift = 3.

Effective advertised rwnd = 3000 × 2³ = 24,000 B

Answer: 24,000 bytes (assumes scaling successfully negotiated).

Example 8 — Window-limited throughput

Given: An effective window of 65,536 B and round-trip time = 0.100 seconds.

Rate ≈ (65,536 × 8) / 0.100 = 5,242,880 bit/s

Answer: approximately 5.243 Mbps.

This is a simplified window/RTT estimate, not guaranteed TCP goodput.

Example 9 — Calculate send window right edge

Given: Cumulative ACK=8000, advertised rwnd=2500 bytes, and no extra cwnd restriction.

Right edge = 8000 + 2500 − 1 = 10,499

Answer: Byte positions 8000–10,499 fall inside the advertised receive window.

Example 10 — Sequence and ACK with two in-order segments

Segment A starts SEQ=10,001 and carries 1000 B. Segment B starts SEQ=11,001 and carries another 1000 B; both arrive in order.

Cumulative ACK = 10,001 + 2,000 = 12,001

Answer: ACK = 12,001.

These problems are original exam exercises unless explicitly attributed to a numbered Forouzan example.

9. APPSC / UGC NET / GATE — 20 Practice MCQs

The questions below are original exam-style practice questions, not claims of verbatim previous-year questions. Choose one answer per question, then click Check Answers.

20 questions · 1 mark each0 / 20 answered

1. TCP sliding-window units are primarily:

Answer: B. TCP numbers data bytes individually. Forouzan contrasts this byte-oriented window with frame-oriented data-link windows.

2. The TCP advertised receiver window chiefly prevents:

Answer: B. rwnd describes how much data the receiving endpoint can accept without overflowing its buffer.

3. If rwnd=4000 bytes and cwnd=6000 bytes, the effective window is:

Answer: B. The sender is limited by the smaller of rwnd and cwnd: min(4000,6000)=4000.

4. A receiver buffer is 5000 bytes and 1000 bytes are unread. What is rwnd?

Answer: B. Assuming no other reservations, rwnd = 5000−1000 = 4000 bytes (Forouzan Example 23.4).

5. ACK=200 and rwnd=9 advertise a receive window covering which bytes?

Answer: A. The left edge is the next expected byte 200; the right edge is 200 + 9 − 1 = 208.

6. In Forouzan Example 23.6, bytes 200–202 are unacknowledged, rwnd=9. How many new bytes may be sent?

Answer: B. The window spans 200–208; 3 bytes are already outstanding, leaving 6 bytes 203–208.

7. TCP cumulative ACK number usually specifies:

Answer: B. The receiver acknowledges the next byte expected in sequence; later out-of-order data cannot advance that cumulative ACK over a gap.

8. Seq=3000, data length=500, no SYN/FIN: next expected ACK?

Answer: C. The data covers byte positions 3000 through 3499, so the next contiguous byte is 3500.

9. Segments 1000–1499 received, 1500–1999 lost, 2000–2499 received: cumulative ACK?

Answer: C. The gap begins at byte 1500, so cumulative ACK stays 1500 even though later bytes were buffered.

10. When the missing 1500–1999 bytes then arrive, and 2000–2499 are buffered, ACK becomes:

Answer: D. All bytes from 1000 through 2499 are contiguous, so ACK advances to 2500.

11. What does a TCP advertised window of 0 normally mean?

Answer: B. A zero advertised receiver window indicates no currently available receive buffer space; probes and other specified exceptions exist.

12. Why does TCP use zero-window probes?

Answer: B. A probe can elicit an updated ACK/window advertisement if an earlier reopening update was lost.

13. Which issue is associated with advertising repeated tiny windows?

Answer: A. Tiny window advertisements and tiny segments waste bandwidth and header overhead.

14. Clark’s receiver-side approach to silly window syndrome waits for:

Answer: B. The textbook advises withholding tiny window updates until a reasonable amount of space becomes available.

15. Nagle’s algorithm primarily aims to reduce:

Answer: B. Nagle buffers subsequent small writes while an earlier small segment is unacknowledged, or sends when enough data accumulates.

16. What can a delayed acknowledgement try to achieve?

Answer: A. Delayed ACKs can reduce standalone ACK packets by waiting briefly for useful outgoing data.

17. TCP's receiver window and congestion window are:

Answer: C. rwnd is advertised by receiver; cwnd is independently maintained by sender as a congestion control variable.

18. Window scaling with shift count 3 and header window 3000 gives:

Answer: D. When window scaling was negotiated, effective advertised rwnd = 3000 × 2³ = 24,000 bytes.

19. Which is a valid outcome of out-of-order TCP reception in the textbook?

Answer: B. Receiver-side TCP can hold out-of-order bytes temporarily, but delivers data in sequence.

20. If effective window=8192 B and 3072 B remain outstanding, what is the simplified new-send allowance?

Answer: C. Allowance = effective window − bytes in flight = 8192 − 3072 = 5120 bytes, assuming both limits share the stated send-window base.

10. FAQs and Quick Revision

What is the TCP sliding window?

It is the moving range of bytes a TCP sender is permitted to have outstanding. Its effective size is limited by receiver flow control and network congestion control.

Is TCP sliding window based on bytes or segments?

TCP sliding-window accounting is byte-oriented. A segment can carry many numbered bytes.

How is the TCP receiver window calculated?

For a simplified receive buffer: rwnd = buffer capacity − currently occupied receive bytes. The receiver advertises its available space.

What is the difference between rwnd and cwnd?

rwnd protects the receiver and is advertised by it; cwnd is maintained by the sender to help avoid congesting the network.

Can a TCP ACK advance across a missing segment?

Not as a cumulative ACK. It remains at the first missing byte, although SACK can separately report later received ranges.

What happens when the receiver advertises a zero window?

New normal data transmission pauses; TCP can use a window probe to discover when the receiver window reopens.

What is silly window syndrome?

It is inefficient TCP behavior involving tiny window updates or tiny transmitted segments, leading to disproportionate header and acknowledgement overhead.

What is Nagle's algorithm?

A sender-side optimization that combines small application writes into larger segments while limiting unacknowledged small sends.

How does a sliding window improve link utilization?

It permits multiple bytes or segments to remain in flight during a round-trip time instead of stopping after every send.

What is the formula for a TCP window-limited throughput estimate?

An approximate upper bound, when a fixed window is the bottleneck, is 8 × window bytes / RTT seconds, in bits per second.

Last-minute formula sheet

FormulaApplication
rwnd = Buffer − OccupiedSimplified receiver buffer availability
Effective window = min(rwnd,cwnd)Actual limiting TCP window (basic exam model)
Available send = Effective − In-flightAdditional new data, given compatible window boundaries
Right edge = ACK + rwnd − 1Receive-window byte range
Next ACK = first missing byteCumulative ACK logic
Window scaling = field × 2^shiftWhen negotiated
Rate ≈ Window × 8 / RTTIdeal window-limited throughput in bit/s

Textbook references

TCP Three-Way Handshake, Termination & States | APPSC Notes

Computer Networks • Transport Layer • Lesson 06

TCP Three-Way Handshake, Connection Establishment and Release, SYN Flooding, TCP State Diagram and Numerical Problems

A complete illustrated tutorial with the TCP SYN–SYN+ACK–ACK exchange, four-segment termination, half-close, 11 TCP states, SYN flood defense, sequence-number calculations and competitive exam MCQs.

TCP HandshakeFIN & TIME_WAIT11 TCP StatesSYN CookiesNumericals & MCQs

TCP is connection-oriented: before ordinary data exchange, two TCP endpoints synchronize initial sequence numbers. When communication ends, each direction is closed, normally using FIN and ACK segments. Understanding how sequence and acknowledgement numbers change is essential for APPSC Assistant Professor, RGUKT Lecturer, UGC NET and GATE.

1. Why Does TCP Need Connection Establishment?

A TCP connection is a logical association between two transport endpoints. It is not a dedicated physical circuit. The underlying Internet Protocol may deliver individual segments by different paths, out of order or not at all; TCP restores the reliable byte-stream abstraction.

Synchronize

Each endpoint chooses an Initial Sequence Number (ISN) and learns the peer's ISN.

Confirm reachability

Each side receives and acknowledges the other's SYN before the normal established state.

Maintain state

TCP maintains buffers, sequence numbers, windows and other connection-specific information.

Three phases of a TCP connection: (1) connection establishment, (2) bidirectional data transfer, (3) connection termination. These phases are explained in both Tanenbaum §6.5 and Forouzan §23.3.

A connection is conventionally identified by a five-tuple: transport protocol, source IP, source port, destination IP and destination port. Two clients can connect to the same server port without becoming the same TCP connection.

2. TCP Three-Way Handshake (SYN → SYN+ACK → ACK)

Step 1 — Client sends SYN: an active opener chooses its initial sequence number x and sends SYN=1, SEQ=x. Since ACK is not set, its acknowledgement field is not valid.

Step 2 — Server sends SYN+ACK: a listening server chooses y and responds with SYN=1, ACK=1, SEQ=y, ACK=x+1.

Step 3 — Client sends ACK: the client acknowledges the server's SYN with ACK=1, SEQ=x+1, ACK=y+1. In the normal no-data case, this final pure ACK consumes no additional sequence number.

Animated three-way handshake

Client (active open)Server (passive open)
1. SYN
SEQ = x
2. SYN + ACK
SEQ = y, ACK = x + 1
3. ACK
SEQ = x + 1, ACK = y + 1
The three lines show the chronological TCP exchange; the repeating CSS animation is illustrative, not a timing-accurate packet capture. Reference: Tanenbaum Figure 6-37(a) and Forouzan Figure 23.18.
Client SYN: x → server ACK: x + 1   |   Server SYN: y → client ACK: y + 1
Critical exam rule: SYN consumes one sequence number even if it carries no application data. A pure ACK normally consumes zero. Some wording in Forouzan's description of the final ACK is inconsistent with its SYN-consumption rule; the equations here follow the standard sequencing also shown in Tanenbaum's Figure 6-37.
StepSegmentSequenceACK numberNew state
1Client SYNxNot validClient: SYN-SENT
2Server SYN+ACKyx+1Server: SYN-RECEIVED
3Client ACKx+1y+1Client established; server becomes established upon receipt

3. Simultaneous TCP Connection Establishment

Normally one endpoint actively opens and the other passively listens. In a simultaneous open, both sides initiate an active open. Each side sends SYN, receives the other's SYN and responds with synchronization/acknowledgement information. For the same socket pair, the result is one TCP connection, not two.

Host A: SYN(x) →
Host B: ← SYN(y)
Both acknowledge the peer SYN
One established connection

Textbook diagram: Tanenbaum Figure 6-37(b). The important contrast is simultaneous open versus ordinary passive/active open.

4. TCP Sequence and Acknowledgement Numbers During Data Transfer

TCP numbers individual bytes, not segments. Each direction has its own independent sequence space. After the three-way handshake, the first application-data byte typically uses ISN + 1.

Next expected byte = starting SEQ + number of contiguous data bytes
ACK value = next in-order byte expected from the opposite endpoint

For example, if a client sends bytes 1001–1500 (500 bytes), the server's cumulative acknowledgement is 1501. If the server also sends 300 bytes beginning at sequence 5001, the client's acknowledgement is 5301. The two ACK values refer to opposite streams.

1001–1500 received1501–2000 lost2001–2500 out of order

After the loss, cumulative ACK remains 1501 until bytes 1501–2000 arrive. Once the gap is filled, it can advance to 2501. SACK may separately indicate the out-of-order received range.

Remember: An ACK-only segment without SYN, FIN or payload does not advance the sender's sequence number. When a segment is retransmitted after loss, it reuses the original data sequence numbers rather than numbering the same bytes again.

5. TCP Connection Termination — FIN and ACK

Since TCP supports full-duplex communication, the two directions of a connection are normally closed independently. A TCP endpoint sending FIN says it has no more application data to send in that direction; it can still receive data until the peer finishes.

Normal four-segment close

Active closer (Client)Passive closer (Server)
━━━━━━━━━━ ➜
1. FIN + ACK
Client finishes sending; enters FIN-WAIT-1
⬅ ━━━━━━━━━━
2. ACK
Server acknowledges FIN; server enters CLOSE-WAIT
⬅ ━━━━━━━━━━
3. FIN + ACK
Server finishes sending; enters LAST-ACK
━━━━━━━━━━ ➜
4. ACK
Client enters TIME-WAIT; server closes on ACK
Simplified FIN/ACK sequence. FIN-bearing segments commonly also have ACK set; the essential control sequence is FIN → ACK → FIN → ACK. Tanenbaum §6.5.6.

Four-segment termination

FIN, ACK, FIN, ACK. The server can continue sending data after acknowledging the client's FIN.

Three-segment termination

FIN, combined FIN+ACK, ACK. This occurs when the passive closer is ready to close its sending direction promptly.

Sequence-space rule: FIN consumes one sequence number. For example, if a FIN has SEQ=7000 and contains no payload, the peer acknowledges it with ACK=7001. The ACK itself consumes none.

6. Half-Close and Simultaneous Close

6.1 Half-close

A half-close occurs when one side sends FIN but continues receiving. Consider a client sending all records for sorting to a server. The client finishes uploading and sends FIN; the server can continue sending the sorted result back before issuing its own FIN. Forouzan explains this through a half-close example (Figure 23.21).

Client finishes upload → FIN
Server ACKs; receives no more client data
Server sends result data back
Server FIN → Client ACK

6.2 Simultaneous close

If both endpoints send FIN before receiving the other's FIN, both may pass through the CLOSING state. The two FINs are acknowledged and the connection eventually terminates. This differs from the simultaneous open discussed earlier.

7. TCP Connection State Diagram — All 11 States

Tanenbaum's Figure 6-38 lists 11 states and Figure 6-39 models the transitions. For exam revision, first memorize the normal active-closer and passive-closer routes; then learn the exceptional CLOSING state.

Normal path — active opener and active closer

CLOSED→SYN-SENT→ESTABLISHED
CONNECT/SYN → receive SYN+ACK/send ACK
ESTABLISHED→FIN-WAIT-1→FIN-WAIT-2→TIME-WAIT→CLOSED
CLOSE/send FIN → receive ACK → receive FIN/send ACK → wait for 2 × maximum segment lifetime (historical description) → close
Conceptual sequence based on the normal path in Tanenbaum Figure 6-39; exceptional transition combinations are described below.

Normal path — passive server / passive closer

CLOSED→LISTEN→SYN-RECEIVED→ESTABLISHED
LISTEN → receive SYN/send SYN+ACK → receive ACK
ESTABLISHED→CLOSE-WAIT→LAST-ACK→CLOSED
Receive FIN/send ACK → local application CLOSE/send FIN → receive final ACK
The passive closer typically enters CLOSE-WAIT while the application decides when to finish its own sending direction.
TCP stateMeaning / reasonTypical trigger
CLOSEDNo active or pending connection.Initial / fully terminated
LISTENWait for incoming connection request.Passive open
SYN-SENTActive opener sent SYN, waits for response.CONNECT → send SYN
SYN-RECEIVEDSYN received; sent SYN+ACK, awaits final ACK.Receive SYN
ESTABLISHEDNormal bidirectional application data transfer.Handshake completed
FIN-WAIT-1Sent FIN; waiting for its ACK or peer FIN.Active close
FIN-WAIT-2Own FIN acknowledged; waiting for peer FIN.Receive ACK of FIN
CLOSE-WAITPeer sent FIN; local application may still send.Receive FIN; send ACK
CLOSINGFINs cross; waiting for ACK of local FIN.Simultaneous close
LAST-ACKPassive closer sent FIN; waits for its ACK.Local CLOSE after CLOSE-WAIT
TIME-WAITFinal-ACK protection and expiry of old duplicates.Active closer ACKs peer FIN
Mnemonic: Active closer: FIN-WAIT-1 → FIN-WAIT-2 → TIME-WAIT. Passive closer: CLOSE-WAIT → LAST-ACK. CLOSING is the crossed-FIN exceptional case.

8. TIME_WAIT, RST and Delayed Duplicate Segments

Why TIME_WAIT exists

The active closer waits after sending the final ACK because the ACK might be lost. Waiting allows it to retransmit the final ACK if the peer sends FIN again, and prevents old duplicate segments from being confused with a later connection using the same endpoints. Tanenbaum describes a wait of twice the maximum packet/segment lifetime in the classic model. This does not mean every operating system has a fixed universal TIME_WAIT duration.

RST versus FIN

FINRST
Graceful termination of one sending direction; normally acknowledged.Abrupt reset, refusal or rejection of an invalid connection.
FIN consumes a sequence number.Not the same as a graceful two-direction FIN close.

The connection establishment protocol must also deal with delayed duplicate segments. Unique initial sequence numbers and bounded segment lifetimes reduce the risk of mistakenly treating old packets as belonging to a new connection.

9. SYN Flooding Attack and SYN Cookies

A SYN flood is a denial-of-service attack in which many connection requests reach a listening TCP server but the handshakes are not completed. The server may accumulate half-open connection state and run short of available resources, affecting legitimate clients.

Conceptual SYN flood

Many apparent clients
SYN →
SYN →
SYN →
✕ No final ACK
Server
Half-open requests
Illustrative only: the attacker may spoof source addresses; an incomplete handshake is not proof that every SYN came from an attacker.

Defense: SYN cookies

As Tanenbaum explains, a server may construct a cryptographically computed initial sequence number from connection information and a secret instead of saving normal half-open state immediately. When a valid final ACK returns, the server checks the cookie and can allocate connection state.

Receive SYN
Generate SYN-cookie ISN
Send SYN+ACK without normal half-open allocation
Validate returned ACK
Create accepted connection
Correct scope: SYN cookies help mitigate server-state exhaustion; they do not eliminate every denial-of-service attack. The textbooks describe some option-handling restrictions associated with their time period. These are historical implementation details, not a claim that every current stack has identical limitations.

10. TCP Sequence and Acknowledgement Numbers — Solved Numericals

The following are original practice examples based on the textbook rules, not claims about previously asked APPSC/NET/GATE questions. Unless noted, examples use normal TCP data transfer without extra SYN/FIN bytes in the segment under discussion.

Example 1: Three-way handshake

Given: Client ISN = 1000, Server ISN = 5000.

SegmentSEQACK
Client SYN1000Not valid
Server SYN+ACK50001001
Client pure ACK10015001

Answer: server ACK = 1001; final client ACK = 5001.

Example 2: ACK after data immediately following SYN

A client had ISN = 2000. After handshake it sends 1200 bytes of data in one segment, starting at SEQ = 2001.

ACK = 2001 + 1200 = 3201

Answer: ACK = 3201.

Example 3: Independent sequence spaces in full-duplex TCP

Client's first data byte is numbered 1501; it sends 500 bytes. Server's first data byte is numbered 8001; it sends 300 bytes. No loss.

Server ACK for client data = 1501 + 500 = 2001
Client ACK for server data = 8001 + 300 = 8301

Answer: Server ACK = 2001; Client ACK = 8301.

Example 4: Lost middle segment and cumulative ACK

TCP receives bytes 1000–1499 and 2000–2499 but bytes 1500–1999 are missing.

Before recovery: ACK remains 1500. After bytes 1500–1999 arrive: all bytes through 2499 are contiguous, so ACK becomes 2500.

Answer: 1500 before; 2500 after.

Example 5: FIN consumes one sequence number

The sender has transmitted all data through byte 7000. Its next sequence number is 7001, and it sends FIN without data.

FIN SEQ = 7001   ⇒   peer ACK = 7002

Answer: ACK = 7002.

Example 6: Three-segment termination

Client's FIN has SEQ = 5000. Server's next local SEQ is 9000. The server immediately sends FIN+ACK.

Client FIN → server ACK 5001. Server FIN+ACK → SEQ 9000, ACK 5001. Client's final pure ACK → SEQ 5001, ACK 9001.

Answer: three segments, with the final ACK = 9001.

Example 7: Retransmission does not renumber data

Segment SEQ = 4001 carries 300 bytes but is lost. The retransmission uses the same byte range 4001–4300.

Expected cumulative ACK = 4001 + 300 = 4301

Answer: retransmitted SEQ = 4001; ACK after receipt = 4301.

Example 8: Sequence-number wraparound

A segment starts at SEQ = 4,294,967,294 and carries four data bytes. TCP has a 32-bit sequence space.

Next SEQ = (4,294,967,294 + 4) mod 232 = 2

Answer: ACK = 2 (modulo 232).

Example 9: Identify the states after FIN/ACK

Host A initiates closure and sends FIN. Host B ACKs it, but has not yet sent its own FIN.

Host A is FIN-WAIT-2. Host B is CLOSE-WAIT (assuming it has not yet closed locally).

Answer: A = FIN-WAIT-2; B = CLOSE-WAIT.

Fast numerical rules: (i) data length N advances SEQ by N, (ii) SYN advances by 1, (iii) FIN advances by 1, (iv) pure ACK advances by 0, (v) cumulative ACK reports the next missing in-order byte, (vi) sequence numbers wrap modulo 232.

11. APPSC / UGC NET / GATE Practice MCQs

These are original practice questions aligned to the concepts prescribed by Assistant Professor / RGUKT syllabi. Expand Answer and explanation to self-check.

Exam tip: Distinguish connection establishment (3 segments) from normal termination (4 segments, possibly 3 if combined), and always count SYN and FIN as one sequence number each.

Q1. How many segments are exchanged during a normal TCP three-way handshake?

  1. 2
  2. 3
  3. 4
  4. 5
Answer and explanation

Correct answer: B. 3. SYN, SYN+ACK and ACK establish the connection.

Q2. Which flag is set in the first segment of an ordinary TCP active open?

  1. FIN
  2. RST
  3. SYN
  4. PSH
Answer and explanation

Correct answer: C. SYN. The client begins by sending SYN with its initial sequence number.

Q3. A SYN has SEQ=1200. What ACK does the peer send for this SYN?

  1. 1200
  2. 1201
  3. 1199
  4. 2400
Answer and explanation

Correct answer: B. 1201. A SYN consumes exactly one sequence number; ACK=1201.

Q4. Server SYN has SEQ=7000. What ACK should the client send?

  1. 6999
  2. 7000
  3. 7001
  4. 7002
Answer and explanation

Correct answer: C. 7001. ACK is the next expected sequence number: 7001.

Q5. A pure ACK carrying no payload, SYN or FIN advances the sender’s SEQ by:

  1. 0
  2. 1
  3. 2
  4. MSS
Answer and explanation

Correct answer: A. 0. A pure ACK does not occupy data sequence space.

Q6. Which normal state follows SYN-SENT after receiving a valid SYN+ACK?

  1. CLOSE-WAIT
  2. ESTABLISHED
  3. FIN-WAIT-1
  4. LAST-ACK
Answer and explanation

Correct answer: B. ESTABLISHED. The client sends the final ACK and transitions to ESTABLISHED.

Q7. Normal TCP connection release usually requires:

  1. 1 segment
  2. 2 segments
  3. 3 segments only
  4. 4 segments
Answer and explanation

Correct answer: D. 4 segments. A FIN and its ACK for each direction make four segments in the ordinary case.

Q8. When can TCP termination be completed in three segments?

  1. When SYN is omitted
  2. When the first FIN ACK and second FIN are combined
  3. When TCP uses UDP
  4. When sequence numbers are disabled
Answer and explanation

Correct answer: B. When the first FIN ACK and second FIN are combined. A combined FIN+ACK from the passive closer can reduce the total to three.

Q9. Which TCP control flag closes a sending direction gracefully?

  1. FIN
  2. RST
  3. PSH
  4. ECE
Answer and explanation

Correct answer: A. FIN. FIN marks the end of the sender’s byte stream in one direction.

Q10. Which TCP flag indicates an abrupt reset?

  1. ACK
  2. FIN
  3. RST
  4. URG
Answer and explanation

Correct answer: C. RST. RST is used for resets or refusal of connection attempts.

Q11. A FIN-only segment has SEQ=4500. Peer ACK should be:

  1. 4500
  2. 4501
  3. 4502
  4. 0
Answer and explanation

Correct answer: B. 4501. A FIN consumes one sequence number.

Q12. In an ordinary active close, the state after receiving ACK of own FIN is:

  1. FIN-WAIT-2
  2. CLOSE-WAIT
  3. LAST-ACK
  4. SYN-SENT
Answer and explanation

Correct answer: A. FIN-WAIT-2. After ACK of its FIN, the active closer waits for the peer FIN in FIN-WAIT-2.

Q13. After acknowledging an incoming FIN, but before locally closing, a passive closer is in:

  1. SYN-RECEIVED
  2. TIME-WAIT
  3. CLOSE-WAIT
  4. FIN-WAIT-1
Answer and explanation

Correct answer: C. CLOSE-WAIT. CLOSE-WAIT means the peer has finished but this endpoint has not yet sent its FIN.

Q14. Which state commonly follows sending the last ACK by an active closer?

  1. LISTEN
  2. TIME-WAIT
  3. SYN-SENT
  4. CLOSING
Answer and explanation

Correct answer: B. TIME-WAIT. The active closer enters TIME-WAIT to handle delayed packets or lost final ACK.

Q15. How many TCP connection-management states are listed in Tanenbaum Figure 6-38?

  1. 8
  2. 9
  3. 10
  4. 11
Answer and explanation

Correct answer: D. 11. Tanenbaum presents 11 states, including CLOSING and TIME-WAIT.

Q16. Two peers simultaneously initiate TCP connections between the same endpoints. This normally creates:

  1. Zero connections
  2. One connection
  3. Two independent connections
  4. A UDP association
Answer and explanation

Correct answer: B. One connection. Simultaneous open establishes one TCP connection for that endpoint pair.

Q17. TCP SYN flooding primarily attempts to exhaust:

  1. DNS TTL
  2. Half-open TCP connection resources
  3. CPU cache tags
  4. IP route entries
Answer and explanation

Correct answer: B. Half-open TCP connection resources. Incomplete SYN handshakes can accumulate server-side connection state.

Q18. A SYN cookie is primarily used to:

  1. Encrypt application data
  2. Remove all IP packet loss
  3. Avoid allocating ordinary half-open state before valid ACK
  4. Replace FIN with SYN
Answer and explanation

Correct answer: C. Avoid allocating ordinary half-open state before valid ACK. The server encodes information into its ISN and validates the returned ACK.

Q19. A client sends bytes SEQ=3001 to 4000 inclusive; next expected ACK is:

  1. 3002
  2. 4000
  3. 4001
  4. 5000
Answer and explanation

Correct answer: C. 4001. 1000 contiguous bytes starting at 3001 make the next expected byte 4001.

Q20. If bytes 1000–1499 arrive, bytes 1500–1999 are lost, and 2000–2499 arrive, cumulative ACK is:

  1. 1500
  2. 2000
  3. 2500
  4. 1000
Answer and explanation

Correct answer: A. 1500. Cumulative acknowledgement stops at the first missing in-order byte, 1500.

Q21. What is the key difference between TCP FIN and half-close?

  1. A half-close sends no FIN
  2. Half-close allows the FIN sender to continue receiving
  3. A half-close uses RST
  4. Half-close disables ACKs
Answer and explanation

Correct answer: B. Half-close allows the FIN sender to continue receiving. After the FIN, the sending direction closes; the opposite direction may still transfer data.

Q22. TCP sequence numbers operate modulo:

  1. 2^8
  2. 2^16
  3. 2^24
  4. 2^32
Answer and explanation

Correct answer: D. 2^32. The TCP sequence number field is 32 bits wide.

Q23. The server has received all client data through byte 9999 and receives a FIN at SEQ=10000. Its ACK becomes:

  1. 9999
  2. 10000
  3. 10001
  4. 10002
Answer and explanation

Correct answer: C. 10001. A FIN at SEQ 10000 consumes one sequence number, making ACK 10001.

Q24. Which statement about TIME_WAIT is most accurate?

  1. It always lasts exactly 30 seconds
  2. It supports final-ACK recovery and expiry of delayed duplicates
  3. It occurs only during initial SYN
  4. It is an application-layer timer
Answer and explanation

Correct answer: B. It supports final-ACK recovery and expiry of delayed duplicates. TIME_WAIT protects the terminated connection; textbook classical model describes 2×MSL, not a universal fixed duration.

12. Frequently Asked Questions

Why is the TCP handshake called three-way?

Because a normal active/passive connection establishment uses SYN, SYN+ACK and ACK, synchronizing both sides' initial sequence numbers.

Does a pure TCP ACK consume a sequence number?

No, not when it carries no data and neither SYN nor FIN is set. It acknowledges data from the opposite direction.

Why does a TCP SYN or FIN consume one sequence number?

It needs an ordered and acknowledgeable position in TCP's sequence space even if it carries no ordinary application data.

Is TCP termination always a four-way handshake?

No. The usual case requires four segments. ACK for the first FIN and the peer's FIN may be combined, making three segments. Simultaneous closes are also possible.

Which host enters TIME_WAIT?

In the normal termination sequence, the active closer that sends the last ACK enters TIME_WAIT. Simultaneous-close cases can involve both endpoints waiting.

What is the difference between SYN-SENT and SYN-RECEIVED?

SYN-SENT is normally the active opener after sending SYN. SYN-RECEIVED is normally the passive opener after receiving SYN and sending SYN+ACK.

What is SYN flooding?

Sending large numbers of SYN connection requests without completing handshakes, potentially exhausting a server's half-open connection resources.

Can TCP receive data after sending FIN?

Yes. FIN ends one direction of transmission; the sending endpoint can still receive until the peer closes its direction.

Why is TIME_WAIT used?

It helps handle retransmission of a lost final ACK and prevents delayed duplicates from an old connection from contaminating later connections.

Is TCP a physical circuit?

No. It is a logical connection over the best-effort IP network. The underlying packets can be routed independently.

13. Textbook References and Exam Coverage

  • Andrew S. Tanenbaum and David J. Wetherall, Computer Networks, 5th ed. §6.2.2–6.2.3 (connection establishment/release), §6.5.5 (three-way handshake, pp.560–561), §6.5.6 (termination, p.562), §6.5.7 (11 TCP states and state machine, pp.562–565). Figures 6-37, 6-38 and 6-39.
  • Behrouz A. Forouzan, Data Communications and Networking, 4th ed. §23.3, especially TCP connection establishment, data transfer, simultaneous open, SYN flooding, termination and half-close (pp.723–729). Figures 23.18, 23.20 and 23.21.
  • Exam alignment: APPSC Assistant Professor CSE (Computer Networks, TCP/IP model and congestion control); APPSC IT Engineering and RGUKT IT (TCP/UDP, sockets and related transport mechanisms); conceptual and numerical preparation relevant to UGC NET and GATE.

Scope: This lesson explains classical TCP mechanisms as presented in the two books; actual modern TCP stacks can include additional features and implementation-specific behavior. All diagrams, exercises and quiz questions are independently created for this tutorial.

Coming next — Lesson 07: TCP sliding window, flow control, receive window, cumulative acknowledgements and window-based numerical problems.

NumPy Tutorial

More

Advertisement

Java Tutorial

More

UGC NET CS TUTORIAL

MFCS
COA
PL-CG
DBMS
OPERATING SYSTEM
SOFTWARE ENG
DSA
TOC-CD
ARTIFICIAL INT

C Programming

More

Python Tutorial

More

Data Structures

More

computer Organization

More
Top